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(^ Abstract 

o 

CN We study generalized regular bent functions using a representation by bent rectan- 

^ gles, that is, special matrices with restrictions on rows and columns. We describe affine 

.^ transformations of bent rectangles, propose new biaffine and bilinear constructions, study 

QQ partitions of a vector space into affine planes of the same dimension and use such parti- 

^~~* tions to build bent rectangles. We illustrate the concept of bent rectangles by examples 

'~^ for the Boolean case. 

o 
u 
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s 



(N 



S3 



Boolean bent functions were introduced by Rothaus [H] and Dillon [7j, and since then have been 
widely studied owing to their interesting algebraic and combinatorial properties and because of 



I> their applications in signal processing, coding theory, cryptography. The current results on the 

O construction, classification, enumeration of bent functions can be found in the surveys [5, 9J. 

Q In the present paper we study bent functions using a representation by bent rectangles. 

■^ Rows and normalized columns of such rectangles consist of the Walsh-Hadamard coefficients 

^Q of Boolean functions and the Boolean functions of rows are simply restrictions of a target bent 

^ function to a subset of variables. 

.!^ The notion of bent rectangles was introduced in [2] and has analogues in other papers. 

rS For example, a special kind of rectangles, all elements of which are equal in magnitude, was 

proposed in [1]. Authors of [3] also intensively dealt with restrictions of bent functions and 
actually used 2- and 4-row bent rectangles. In [TOl preliminary version], Z-bent squares that are 
defined for integer-valued functions are used to construct Boolean bent functions recursively. 

We extend the results of [2] in the following directions. In Sections ^ p^ we transfer the 
concept of bent rectangles to the generalized regular bent functions over an arbitrary quotient 
ring of integers (see [H]). In Section [s] we describe affine transformations of bent rectangles. 
In Section [5] we propose new constructions of bent functions which are based on biaffine and 
bilinear mappings. In Section [6] we study partitions of a vector space into affine planes of the 

*Subinitted to: Proceedings of the NATO Advanced Study Institute on Boolean Functions in Cryptology and 
Information Security (Moscow, September 8-18, 2007). 



same dimension and use such partitions to construct bent rectangles. Additionally, in Section |4] 
we illustrate some known properties of Boolean bent functions by using bent rectangles. 

The author plans to continue this paper and discuss further dual bent functions, bent 
rectangles with a small number of rows, and cubic Boolean bent functions. 

1 Functions 

Let Z^ be the ring of integers modulo q which we identify with the set {0, 1, . . . , g — 1}. Denote 

o o 

by Zg the set of all gth roots of unity in C and introduce the additive character %: Zg ^ Zg, 
x(a.) = exp(27rza/g), where i = \^—l. The ring of integers modulo a prime g is a field. We 
emphasize this fact by writing F^ instead of Zg. 

The set l^ = Z^ consists of all vectors a = (ai, . . . , a„), Oj G Z^, and forms a group under 
vector addition. If q is prime, then Vn is the n-dimensional vector space over the field F^. 

Let 3^n be the set of all functions V„ — * Zg. A function f & 3^n depends on n variables — 
coordinates of the argument x = (xi,...,x„). Given J = {ji, ■ ■ ■ ,jm} ^ {!;• ••>'"'}) the 
restriction of /(x) to (x^^, . . . ,Xj^) is a function obtained from / by keeping variables Xj, 
j ^ J, constant. 

o o o 

Starting from /, construct the function f : Vn ^ liq, f {'x.) = x(/(x)), and the function 

/ : K ^ C, 

xev„ 
Here u ■ x = uiXi + . . . + UnXn and the bar indicates complex conjugation. It is convenient to 

O A 

assume that ff'o consists of constant functions f = c, c & Zg, for which f = f = x(c). Denote 

O A A 

The conversion / t— > / (or / i-^ / ) is called the Walsh-Hadamard transform. Since 

Ex(au) = |^"' " = °' 
■^ otherwise 

A O 

for each a G Ki, the inverse transform f ^^ f can be defined as follows: 

/(x) = g-"5^/(y)5^x(u-(x-y)) 

o 

= ^~" Zl Zl •^ (y)x(u • y)x(u ■ x) 

uev„ yeVn 

= g-"5^/(uMu-x). 

uev„ 

The Walsh-Hadamard transform is often used in cryptography, coding theory, signal pro- 
cessing to derive some properties of /. In many cases it is important to use functions / with 

A 

the characteristic maxu | / (u) | as small as possible. Due to the Parseval's identity 

uey„ 



we have maxu | / (u)| > g"/^, where the equahty holds if and only if 

|/(u)|=g"/2, uGK. (1) 

A O 

If / satisfies ([l]), then it is called a bent function. If, additionally to ([l]), / (u) G q"'^'^ Zg for 
all u, then / is called a regular bent function. Let !B„ be the set of all regular bent functions 
of n variables. 

Further all subscripts, superscripts and other notations defined for 3^n are automatically 

O O A A 

transferred to all subsets of ?"„. For example, ^n = {/ : / G B^}, "B n = {f '■ f & S„}. Note 
that S„ = g"/2 2^. 

2 Rectangles 

□ 

Let m, k he nonnegative integers and / G 3^m+k- Define the function / : Vm+k -^ C, 

/(u,v)=5^/(u,y)^^(7T^, uGKn, ^rEVk, (2) 

yeVfc 

D 

and call it a rectangle of /. Denote by 3^ rn,k the set of all such rectangles. For the case m = k 

D 

we also call / a square of /. 

D A 

To each function / there correspond different rectangles of the sets J'o.m+fc = ^ m+k, 

n □ n o 

ff'i^m+fc-i, . . ., 3^rn+k-i,i, 9^m+fc,o = 3^ m+k- These rectaugles are connected with each other. 

□ D □ D 

For example, if / G 3^ m,k and /* G 3^m+i,k-i, then 

D o 

f{u,v,V) = Y^ Y^ f{u,y,y')xivy + V-y') 

yeZqy'€Vk-i 

and conversely. 



/ *(u, v,v) = -22f (U' ?/. v')x(f y)- 



q 

For a fixed u call the mapping v i-^ / (u, v) a column of / . Analogously, for a fixed v 

D D DA 

call the mapping u i-^ / (u, v) a row of / . By definition, each row of / is an element of 5"^. 

□ A 

If furthermore each column of / multiplied by g('"~'^)/2 is an element of 5"^, then call the 

□ 
rectangle / bent. 

Our results are based on the following proposition, first stated in (2] for the case q = 2. Note 

that under m = this proposition can be considered as a definition of regular bent functions. 

Proposition 1. A function f G 3^m+k is regular bent if and only if the rectangle f G 3^m,k is 
bent. 



Proof. Let / G S„, n = m + k. Define the function (7 G ?"„ by tlie rule 

O A 

^(v,u) = g-"/V(-u,v), ueVm, vG\4, 
and determine tlie corresponding rectangle g & 9^ k,m'- 
g (v, u) = g-"/2 J2 f (-^' ^)XK^ 

XGKn 



xeF™ weV™ yeVfc 

yeVfe 
= g(-^)/V(u,v). 

D AD 

Therefore, each column of / multiplied by g(™-~^)/2 is an element of 3"^ and / is bent. 

D D D 

Conversely, if / is bent, then g('v,u) = g*^™'"'^)/^ / (u, v) is well defined rectangle that 

O A A O 

corresponds to the function g{'v,u) = g~"/^/(u, v). Hence /(u, v) G g"/^Zq for all u, v 
and / is regular bent. D 

D D D 

It is convenient to identify / G 3^ m,k with the g™ x q'^ matrix F whose rows and columns 
are marked by lexicographically ordered vectors of Vm and Vk respectively and whose elements 

D 

are the values / (u, v). 

D D 

The definition of F puts restrictions on its rows. The bentness of F puts additional re- 
strictions on columns. We can draw an analogy with latin rectangles and this analogy justify 
the use of the term "bent rectangle" . 

D D D 

If F corresponds to a bent rectangle / G B m,k and satisfies restrictions on rows and 

n □ 

columns, then G = g(™~'^)/2 ^t^t g^jg^ satisfies such restrictions and corresponds to a bent 

D D D D □ 

rectangle g E "B k,m- Call the transformation f \-^ g a. transposition of / . During the proof of 
Proposition [1] we actually showed that, under the transposition, 

O A 

^(v,u) = g-"/V(-u,v), uGKn, vGKfc. 

As "material" for constructing bent rectangles we will often use afiine functions /(x) = 
b ■ X + c, where x, b G Ki and c G Zg. Denote by An the set of all afiine functions of n variables. 

A 

The function / that corresponds to / has the quite simple form: 

Uu) = i ^"^^^)' if u = b, 
1 otherwise. 

This fact immediately gives us the following construction. 



Example 1 (Maiorana-McFarland's construction). Consider a bent square / E "B n,n such 

AD n 

that all its rows and columns belong to An- The matrix F associated with / has the following 

o 

form: each its row and each column contains exactly one element of the set g"Zg, all other 
elements are zero. It means that there exists a permutation vr : Vn ^ Vn and a function ip E 3^n 
such that 

j(u^v) = I ^"V^H' ifv = 7r(u), 
[^ otherwise. 

Consequently, /(x, y) = 7r(x) ■ y + v'(x) and we obtain the well-known Maiorana-McFarland's 
bent function. D 

3 Affine transformations 

Let GL„ (AGL„) be the general linear (affine) group of transformations of Vn = VI- We 
identify GL„ with the set of all invertible nxn matrices over Z^ and denote by /„ the identity 
matrix of GL„. An element a G AGL„ is specified by a pair (A, a), A G GL„, a G Vn-, and 
acts as follows: <y{x) = xA + a. Extend the action of AGL„ to functions / with domain Vn in 
a natural way: 

a(/)(x) = /(xA + a). 

Call functions f,g E 3^n (iffine equivalent if there exist a = (A, a) G AGL„ and / G An, 
/(x) = b ■ X + c, such that 

g{^) = a(/)(x) + /(x) = /(xA + a) + b ■ X + c. (3) 

If / and g are affine equivalent, then 

^ (u) = ^ x(/(xA + a) + X ■ (b - u) + c) 

xev„ 

= E ^(/(y) + (y - ^)^"' ■ (b - u) + c) 
= E ^(/(y) - (y - ^) ■ (^ - b)(^"T + c) 

yeVn 

and 

^(u) = x(a-v + c)/(v), v = (u-b)(A-y. (4) 

A A 

Therefore, the functions / and g are, in some sense, also affine equivalent: there exist a* G 
AGL„ and I* G An such that 

giu)=a*{f){u)riu). 

D D □ 

It is useful to describe a connection between rectangles f ,g G 3^m,k of affine equivalent 

functions. For example, g G !B„ if and only if / G B„ and a correspondence between / and g 
can be used to perform the affine classification of regular bent functions. 

Let n = m + k, where m,k > 1. Divide the vector x G K* into two parts: x = (xi,X2), 
xi G Vm, X2 G Vk, and introduce the following elementary transformations f ^^ g'- 



Al) ^(x 

A2) (?(x 

Bl) g{^ 

B2) (7(x 

CI) g{^ 

C2) (7(x 



/(xiAi + ai,X2), where Ai G GL^, ai G K^; 
/(xi,X2A2) + a2 ■ X2, where A2 G GLfe, a2 G V^; 
/(x) + bl ■ Xi + c, where bi G Kn, c G Z^; 
/(xi,X2 + b2), where bs G \4; 

J yXi, . . . , Xm—i, X-iji XjYi+l) •^m+1) ^m+2 • • • ; •^nj) 
J yXi, . . . , Xm—lj Xm) •^m+1 •^rri) •^m+2? ■ ■ ■ ; •^n) ■ 



Proposition 2. Every affine transformation f ^^ g of the form (pi) can be realized using only 

DO D 

elementary transformations Al - C2. Under these transformations, the rectangles f ,g & 3^ m,k 
are connected in the following manner: 

a n 

Al) g (u, v) = / (uAi + ai, v), 



A2) g (u, v) = / (u, (v - a2)fi2), where B2 = {A 



^l\T. 



Bl) g (u, v) = x(bi ■ u + c) / (u, v); 

B2) ^(u,v) = x(b2-v)/(u,v); 

CI) g{u',u,v,V) = - 22 fi^'^^^y^^')x{{u-x){v-y)); 



q 



x,y(il 



C2) g (u', u, V, v') = / (u', M, V, V)x{uv) . 

Here u G K„, v G Vk, u' G Kn_i, v' G Vk-i, u,v e Z,. 

Proof. To prove the first part of the proposition, we wiii establish that GL„ is generated by 
the matrices of its subgroups 



Gi 



Ml 



: Ml G GL.„ 



G, 







: M2 G GLfc 



04; J [ \ M2 

and additional matrices R and S of the following linear transformations: 

X I > XiX y^ly • • • 5 •^m— 15 -^m -^m+lj -^m+lj '^m,+2; • • • ; ■^nj; 
X I > XD l,-^!; • • • 5 •^m—lj •^'mi ■^m+1 -^m, Xj72-)-2; • • • > Xnj. 

It is known (see, for example, [I5]) that the group GL„ over the Euclidian ring Z^ is 
generated by matrices of the following transformations of a vector x: 

1) multiplication of the coordinates Xi by invertible elements of Z^, 1 < i < n; 

2) subtraction of Xj from Xj, 1 < ^, J < ?t-, i 7^ j- 



The groups Gi and G2 contain matrices which reahze all transformations of the first type 
and transformations of the second type for 1 < i,j < m and m + 1 < i,j < n. We can subtract 
any different coordinates of x using additional matrices R and S. For example, the subtraction 
of Xj, m + 1 < j < n, from Xi, 1 < i < m, can be realized by the following steps: a) interchange 
Xi and Xm using some matrix of Gi, b) interchange Xm+i and Xj using some matrix of G2, 
c) subtract x^+i from x^ using R, d) interchange Xi and Xm, Xm+i and Xj again. Thus, the 
group generated by Gi, G2, R, S contains all matrices of the first and the second types and 
this group coincides with GL„. 

The second part of the proposition is checked by direct calculations. Consider, for example, 
the transformation CI. We have 

□ o 

g{u',u,v,V) = Y^ Y^ g{u,u,x,y')x{vx + V -y') 

o 

= ^ ^ / (u', M - X, X, y')x{vx + v' ■ y') 

x&qy'eVk-i 

o 

= ^ ^ f{M!,x,u-x,y')x{v{u-x)+\'-y') 

x&Lqy'^Vk-i 
1 o 

= - ^ ^ J{y^,x,z,y')x{{u-x)[v-y)+yz + V -y') 
= - y] /(u',a;,t/,v')x((M-x)(t;-|/)) 

x,y£'Lq 

and the required identity holds. D 

□ 
Therefore, we can realize any afiine transformation of a rectangle F by affine permutations 

of its rows (Al) and columns (A2) and by multiplying its elements by gth roots of unity (Bl, 

□ 
B2, C2). The remaining transformation CI is a single method of changing the elements of F 

in magnitude. 

Example 2 (cells). For the case g = 2 it is convenient to illustrate the transformations CI, C2 

in the following way. Divide F into the cells, that is, the submatrices 

7(u',0,0,v') /(u',0,l,v'A ,^.. ,^.. 

/(u',l,0,v') /(u',l,l,v')/ 
and during the transformations modify all of the cells simultaneously by the rules 

1/q; + /3 + 7 — 5 q; + /9 — 7 + (5\ (a I3\ (a j3 



n 



4 Illustrations 

In this section we consider the case q = 2 and give examples to illustrate the usage of bent 
rectangles for the analysis of some known properties of bent functions. Note that in the Boolean 
case each bent function is regular and !B„ 7^ only for even n. 




Start with some useful definitions and facts. Firstly, identify a Boolean function f & 3^n 
of X = (xi, . . . , Xn) with its algebraic normal form, that is, a polynomial of the ring F2[xi, . . . , x^] 
reduced modulo the ideal (x^— Xi, . . . , x^— x„). Denote by deg / the degree of such a polynomial. 

Following [16], introduce the set '?n,r ^ 9^n of plateaued functions of order r: f E 'J'n,r if 

A A 

I /(u)| G {0,2""'"/^} for all u e V^ (more precisely, / has exactly 2'' nonzero values ±2""'"/^). 
It is clear that An = yn,0) ^n = 'Pn,n- 

Finally, recall the following result of [2]- 

Lemma 1. Let q = 2, /i, /a, /s, U ^ 5"^ and 

^(u) = ^(/i(u) + /2(u) + /3(u) + /4(u)), uGK. 

A A 

The function g e3^ n if and only if 

/l(x) + /2(X) + /3(X) + /4(X) = 1, X G K. 

Under this condition, g{x) = /i(x)/2(x) + /i(x)/3(x) + /2(x)/3(x). 

Turn to examples. 

Example 3 (sums of bent functions). It is well-known (see ^4]) that if /i G B^ and /a G S^, 
then /(x, y) = /i(x) + /2(y) is also bent. Indeed, the rectangle / G 3^ m,k has the form 

□ O A 

/ (u, v) = / i(u) / 2(v) and obviously satisfies the restrictions on columns. D 

Example 4 (degrees of bent functions). Let / G 'B2n, n > 2. In [H], Rothaus proved that 
deg f < n. Give an alternative proof of this fact. 

Suppose to the contrary that deg/ = k > n, i.e. the polynomial /(xi,. . . ,X2n) contains 
a monomial of degree k. Without loss of generality, assume that / contains the monomial 
Xm+iXm+2 ■ ■ ■ X2n, m = 2n — k. Then there are an odd number of I's among the values g{y) = 

A 

/(O) y)) y ^ H;; and g (0) = 2r, where r is odd. It is impossible when k = 2n, since in this case 

A A n n 

g (0) = / (0) G {±2"}. Therefore k < 2n and consequently m > 0. Consider / G 3^,^- We 

DAD A 

have / (0, 0) = g (0) = 2r and 2(™~'^)/^ / (0, 0) is not even integer. Since functions of 3"^ take 

□ 

only even values, the restrictions on columns of / are not satisfied, a contradiction. D 

Example 5 (2-row bent rectangles). Let / G Si^„_i. By definition, the columns of / belong 
to the set 2"/^~^3'i. Since 3^i = Ai, each column takes exactly one nonzero value ±2"/^. It 

D A 

means that all rows of / are in 7 n~i,n-2- This fact was pointed out in [TB] . 

In Proposition p^ we will describe how to construct (2"' — 2)|B„_2p bent rectangles of S i,„-i. 

□ 
For example, such a construction allows to obtain all 896 elements of 3 1.3. D 

D D 

Example 6 (4-row bent rectangles). Consider a rectangle / G B 2.n-2- Since every function of 
3^2 is either afiine or bent, the possible values of / are exhausted by 0, ±2"/^^^, ±2"/^. 

D o 

If we restrict to the numbers ±2"'^~^, then each column of / belongs to 2"'^~^!B2, takes 
an odd number of negative values, and a product of these values is exactly —2'^^~'^. This result 
was proved in [T3] . 

8 



If we restrict to the numbers 0, ±2"/^, then we obtain a bent rectangle all rows of which are 
in T„_2,n-4. Proposition y will give 8(2"-2 - l)(2"-3 - 1)(7 ■ 2"-3 - 13)|S„_4|^ such rectangles 
for n > 4. n 

Example 7 (Rothaus' construction). Let /i,/2,/3,/4 e S„ satisfy /i(y) + /2(y) + /3(y) + 
/4(y) = for all y G V„. In [13], Rothaus showed that the function 

fiu^,u2,y) = /i(y)/2(y) + /i(y)/3(y) + /2(y)/3(y) 

+ Mfiiy) + /2(y)) + Mhiy) + /3(y)) + ^1^2 

□ D 

is bent. Give another proof of this fact using the rectangle / G 3^2,n- 
Lemma hi implies that / has the following form: 

/" A A A A 



° 1 

/(m1,W2,v) = - 



/l(v) + /2(V) + /3(V) - /4(V), Ui=U2 = 0, 

/1(V)-/2(V) + /3(V) + /4(V), U, = 0, U2 = l, 

/1(V)+/2(V)-/3(V) + /4(V), U, = l, U2 = 0, 

A A A A 

/l(v) - /2(v) - /3(v) - /4(v), Ui = U2 = 1. 



(5) 



Choose an arbitrary v and construct the function h G 3^2'- h{0,0) = 2 "^^/i(v), h{0,l) = 
2-"/2/2(v), ^(1,0) = 2-"/2/3(v), ^(1,1) = -2""/2/4(v). By Q, the vth column of / 

A D 

coincides with 2"/^^^ h . Hence / satisfies restrictions on columns and / is bent. 

Observe that the function f {ui,U2,'y) can take all the values 0, ±2*^'^"^, ±2"''^ and the 
Rothaus' construction provides more subtle 4-row rectangles than ones considered in the pre- 
vious example. D 

Example 8 (Carlet's transformation). Let / G B2n, E C V2n be an afiine plane of dimension 
k > n, and (J)e G 9^2n be the support of E, that is, 0b(x) = 1 if only if x G -E. In \6', p. 94], 
Carlet obtained conditions which provide the bentness of the function g{x) = /(x) + 0£;(x). Let 
us prove yet another condition: g G 232n if and only if /e G yfc,2(A;-n)! where /e is a restriction 
of / to E, that is, /^(y) = f{ip^^{y)) for some afiine bijection (p: E -^ Vk- 

Without loss of generality, assume that E = {(0, a) : a G Vk} and (p: (0, a) \-^ a. Consider 

the rectangles f &'B 2n-k,k and g G 3^ 2n-k,k- They differ only in the first row: 

/(0,v) = /^(v), ^(0,v) = -/^(v). 



Let / £;(v) 7^ for some v. Consider the normalized columns h (u) = 2" '^ / (u, v) and h'(u) = 

a AAA 

2"'~'^ g (u, v). The functions h G 3^2n-k and h' differ only in signs of their (nonzero) values at 

A A A 

u = 0. Therefore, h' G 3^2n-k if and only if h (0) = ±2^""'^. Under this condition, 

/^(v) = /(0,v)=2'=-'^/l(0) = ±2". 

n A 

Consequently, g is bent if and only ii f e takes only the values 0, ±2", that is, /e G yfc,2{/c-n)- □ 

9 



Example 9 (normal bent functions). Following [8], call a function / G 'B2n (weakly) normal if 
its restriction to some n-dimesional afiine plane is affine. In other words, / is normal if there 
exists an affine equivalent function g such that 

M{g) = max I ^ (u, v) | = 2", g e "B „,„. 

U,veVn 

Using the affine classification of bent functions of 6 variables (see [E]), one can check that 

every / G Se is normal. We give a direct proof of this fact by applying the results of Section |3j 

Write if ~ a^^ag^ . . . for a function ip that takes di values ai, d2 values a2, and so on. If 

A A A A A □ D 

/i G J'a, then | /i | ~ S^'^O^ or | /i | ~ 6"'^2^ or | /i | ~ 4^0^*. Since all rows and columns of / G B 3^3 

A 

are in 3^3, we have M(/) G {4,6,8}. 

Let M(/) = 4. Applying the elementary transformations Al, A2 (i.e. permuting rows and 

columns) and Bl, B2 (i.e. changing signs of rows and columns), we can arrange elements of / 
into one of the following cells: 

'4 4\ ^4 4 \ U 4' 
,4 0/' U-4J' (44 

Then apply CI, C2: 

U 4\ CI /^6 2\ /4 4 \ ci /8 0\ /4 4\ C2 /4 4 \ ci /8 O' 
^4 0) '^ [2 2) ' [a -a) ^ [o 0) ' \4 4) ^ ^4 -4) ^ [o 0^' ' 

and obtain a rectangle that takes the value > 6. So it is sufficient to treat the case M(/) = 6 
only. In this case we proceed in a similar manner: 

A1,A2,B1,B2,C2 16 2\ci/8 

' \^2 -6J ~^ [o -4^ 
and obtain a rectangle that takes the value 8, which is what we wanted. D 

A 

Example 10 (the number of bent functions). If (? G 7n,2, that is, g (a^) = 2"~^x(6j) for some 
bi G F2 and distinct aj G Vn, i = 1,2, 3, 4, then by Lemma [T] 

(i) ai + a2 + a3 + a4 = 0, 

(ii) bi + b2 + h + h = 1. 

In [2], we proposed an algorithm to construct bent squares / G B„,^ all rows and columns 

A A □ 

of which are elements of yi„ U 7 n,2- The algorithm arranges nonzero elements in the matrix F 
subject to the condition (i) and then places signs of elements subject to (ii). 

Counting different outputs of the algorithm, we obtain constructive lower bounds for | B „,„|. 
In particular, the algorithm provides 1559994535674013286400 > 2™'^ distinct bent squares of 
^4^4 and, consequently, jSgl > 2™-*. D 



10 



5 Biaffine and bilinear bent squares 

Consider a mapping tt : V^ x K„ — > V^. As previously, for a fixed v call the mapping u i— >^ 7r(u, v) 
a restriction of vr to u, and for a fixed u call the mapping v ^-^ 7r(u, v) a restriction to v. Say 
that 71 is biaffine {bilinear) if all its restrictions to u and v are affine (linear) transformations 
of Vn- A biaffine mapping is nonsingular ii all its restrictions are invertible. A bilinear mapping 
is nonsingular if all its restrictions to u for v 7^ and to v for u 7^ are invertible. 

Choose an arbitrary function g E 3^n and construct a bent square / G S „.„ such that the 

D A 

corresponding matrix F consists almost only of the values of g permuted in some order and 

O AD 

multiplied by elements of Z^. Informally speaking, we "scatter" values of g over F . The 
connection Q between the Walsh-Hadamard coefficients of affine equivalent functions allows 
us to make such a scattering using a nonsingular biaffine or bilinear mapping. The obtained 
constructions are given by the following two easily verified propositions. 

Proposition 3 (biaffine bent squares). Let n be a nonsingular biaffine mapping VnXVn^ Vn, 
g G 3^n, V ^ 3^2n; O'TT'd all restrictions of ip{u,\) to u G Vn and v G V^ o'^e affine functions. 
Then the square 

D o A 

/(u,v) = ^(u,v)^(7r(u,v)) 
is bent. 

Proposition 4 (bilinear bent squares). Let it be a nonsingular bilinear mapping VnXVn —^ Vn, 
g G 3^n, ^ be defined as in the previous proposition, and h, h' G 3^n be such that 

h{0) = h'{0), h{n) = °^{u,0)g{0), /l'(v) = (^ (0, v) ^ (0), u,vGK\{0}. 

Then the square 

° / hiO), u = v = 0, 

I (/? (u, v) (7 (7r(u, v)) otherwise, 
is bent. 

Note that any function of the form 

n n n 

ip{Ui, ...,Un,Vi,...,Vn)=^ QijUiVj + ^ PiUi + ^ 'JiVi + 6, aij,Pi, Jj, 6 G Zg, 

satisfies the condition of the above propositions. Note also that in Proposition |4] we can easily 

A 

construct h and h' if g (0) = 0. Indeed, in this case it is sufficiently to choose h = h' = c, 

c G Zq. 

In Proposition [3] we can use the following nonsingular biaffine mapping 

7r(u, v) = uA + v5 + (uCiv'^, . . . , uC^v'^) + d, 

where d G V„ and A, B, Ci, . . . ,Cn are nx n matrices over Zg such that A + (Civ""", . . . , Cnv""") 
and B + [CiU^, . . . , C'^u^) are invertible for every v and u. 
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Further, each nonsingular bihnear mapping vr has the form 

7r(u, v) = uAy,, (6) 

where A^ are n x n matrices over Zg such that 
(i) Aq = and A^ G GL„ for all nonzero v G V^; 

(ii) v4v+v' = ^v + ^v' for all v, v' G K- 

Indeed, considering restrictions of n to u, we get ([6]). Since each such restriction for v 7^ 
must be invertible, A^ G GL„ for all nonzero v. For each fixed u the mapping v \-^ uAy, must 
be linear. Therefore, uAv+v' = u{Av + A^/) for all v and v', which yields (ii) and the first part 
of (i). 

Assume further that q is prime. The arising structure R = {A^: v G Vn} is connected with 
some concepts of projective geometry. Consider the following linear subspaces of V2n'- 

^oo = {(0,v): vGK}, Sv = {(u,uAv):uGK}, v G K- (7) 

Each such subspace is of dimension n, two different subspaces intersect only in the zero vector 
and, consequently, the union of subspaces is V2n- A set of subspaces with these properties is 
called a spread of V2„. 

Observe that the condition (ii) is too strong for the set ([T]) to be a spread. We need only 
that A — A' & Ghn for all distinct A,A'&R (with the additional property /„ G R such a set 
R is called a quasifield). 

Spreads are used in the following well-known construction of bent functions. 

Example 11 (Dillon's construction). Consider a spread (JTl) determined by aset R = {Ay, : v G 

A 

Vn}. Choose c G Fg and g E 3^n such that giO) =0. In ^, Dillon actually proved that the 
function / G 3^2ni 

f(\ J C, X G -C/QO; 

1 ^(v), xGEv\{0}, 
is regular bent. 

The corresponding bent square / G B „ „ has the form 

{g"x(c), u = V = 0, 
y g (y)x(uy4y ■ v) otherwise. 
yey„ 

We see that the Dillon's bent squares are similar to the bilinear ones. In particular, if elements 
of R satisfy the conditions (i) and (ii), then the Dillon's construction is covered by Proposition [3] 
under the choice h = h' = c, ip = 0, 7r(u, v) = "vB^, where the matrices i?u are such that 
uAy = yBu for all u, y G Vn- □ 

Remark that the Maiorana-McFarland's bent squares can be represented in the form of 



s 



Proposition |4 with only the refinement that g is necessarily afiine. The simple form of g in this 
case allows to relax the conditions of the proposition: we can use an arbitrary ip and choose 
7r(u, v) such that all its restrictions to u and v are bijections (possibly not afhne). 
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6 Partitions into affine planes 

Let q be prime and L be a linear subspace of V^ = F" of dimension r. Write the latter as 
L < Vn, dimL = r. Recall that the number of distinct r-dimensional subspaces of Vn is given 
by the Gaussian coefficient 

n\ (g'^-l)(g'^-i -l)...(g"-^+^-l) 

< r < n. 



rjg (q^ - l)iq'-^ - 1) . . . (q - 1) 

Let ii^ = L + b be an affine plane obtained by a shift of L by a vector h & Vn. The plane E 
is the image of the affine mapping ir: Vr —>■ Vn, w i— > wA + b, under a suitable choice of the 
r X n matrix A over Fg of rank r. 

Given g & 3^r, construct the function h E 9^n, 

/i(x) = g{^A^) + b ■ X, X G K. (8) 

Call the transformation g \^ h a stretching of g to the plane E. Under the stretching 

Mv)= 5^^(xATM(b-v)-x) 

xGV„ 

= q"'Yl Y.9 (w)x(xAT ■ w + (b - v) ■ x) 

= q''' ^ 9 (w) Y^ X((vr(w) - v) ■ x) 
weVr xeVn 



and, consequently, 



otherwise. 



Describe bent rectangles / G "B m,n, m = n — r, which have all rows of the form tej) and 

A 

all columns in the set cf^'^ Am- Such bent rectangles were first introduced by Carlet [1] for the 

case q = 1. Note that after the transposition of / we obtain the rectangle / * G 23 n,m that 
corresponds to the so called (see [12]) partial affine bent function /* G 'Bn+m'- each restriction 
of /*(x, y) to X G Vn is affine. 

Proposition 5 (partitions into affine planes). Let m, r be nonnegative integers, n = m + r, 
u G Vm, V G Vn, and 

[ otherwise, 

where g^ G B,. and tTu are mappings Vr ^ Vn such that E^ = TTuiVj-) o^i^^ affine planes of 
dimension r. If the planes {-Eu} o'^e disjoint and therefore determine a partition ofVn, then f G 
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Example 12. Let q = 2. Choose the following partition of V4 into the planes of dimension 2: 

i?(o,o) = {(0, 0, 0, 0), (0, 0, 0, 1), (0, 0, 1, 0), (0, 0, 1, 1)}, 
E(o,i) = {(0,1,0,0), (0,1,0,1), (1,1,0,0), (1,1, 0,1)}, 
E(i,o) = {(0, 1, 1, 0), (0, 1, 1, 1), (1, 0, 0, 0), (1, 0, 0, 1)}, 
E(i,i) = {(1, 0, 1, 0), (1, 0, 1, 1), (1, 1, 1, 0), (1, 1, 1, 1)}. 

□ n 

Using this partition, construct a rectangle / G S 2,4 with the matrix 
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where signs of the elements are determined by unspecified bent functions gu ^ '^2- Q 

It is convenient to assume that every one-element subset of a vector space is an affine 
plane of dimension and that Bq = J'o- Then under r = the above proposition gives us all 
Maiorana-McFarland's bent squares. 

In general. Proposition [5] allows to construct 



(g'")!c,(n,m)|S„_ 



19" 
■ml 



distinct regular bent functions oi n + m variables. Here Cq{n,m) is the number of distinct 
partitions oi Vn = ¥^ into g™ affine planes of dimension n — m. 

To obtain estimates for Cq{n,m) consider some partition {Ei, E2, . . . , Eqm} counted by 
Cg{n,m). Let E^ = Li + bj, where Lj < Vn, bj G ¥„, and 

ly = Li nLs n ... nL^m. 

Call the partition {Ei} primitive ii W = {0}. Denote by c*{n,m) the number of distinct 
primitive partitions of V^ into planes of dimension n — m. 

Suppose that {Ei} is not primitive, that is, d = dimPi^ > 1. Then Vn can be represented as 
the direct sum U © W, U < Vn-, dim U = n — d, and each plane Ei takes the form {u + w : u G 
E'i, w G W}, where E^ = Ei (1 U is a.n affine plane of U of dimension n — m — d. The planes 
E[, E2, . . . , E'm determine a primitive partition of U. There are c*{n — d, m) ways to choose 
such a partition, f ^ j ways to choose W and, consequently. 



1 



n—m / s 

c>,m)=x:(;;) 



1 

d=0 ^'^^ 1 



c*Jn-d,m). (10) 



Denote by Li + Lj the subspace of Vn consisting of the sums v + v', where v runs over Li 
and v' runs over Lj. For each distinct i,j G {1, 2, ... , g™} we have 

dim(Lj n Lj) = dimLj + dimLj — dim(Lj + Lj) > 2{n — m) — n = n — 2m. 
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If diin(Lj n Lj) = n — 2m, then Li + Lj = Vn and bj — bj = v + v' for some v G Lj, v' G Lj. It 
means that 

\Ei n Ej\ = \L, n {Lj + V + v')| = |(Li - v) n (L^ + v')| = \Li n L^l 7^ 0, 

a contradiction. Hence 

dim(Li n Lj) > n - 2m + 1. (11) 

Under m = 1 this inequality yields that Li = . . . = Lq = W, where diml^ = n — 1. 
Therefore, c*(l, 1) = 1, cl{n, 1) = for n > 2, and 

For the case g = 2 we also obtain the estimate 

(cf. Example [6]) using the following result. 

Lemma 2. c^(2, 2) = 1, c^(3, 2) = 98, and cl{n, 2) = for n > 4. 

Proof. The first equality is trivial. Further, if g = 2 then each partition of V3 into two-element 
subsets is also the partition into affine planes. There are -^ = 105 such distinct partitions and 

4(3,2) = 105- P") c;(2,2) = 98 

of them are primitive. 

We prove the third equality by a contradiction. Suppose that n > 4 and {Ei = Lj + bj : i = 
1,2,3,4} is a primitive partition of V^ into planes of dimension n — 2. Let us analyze the 
properties of such hypothetical partition which help to reveal a contradiction. 

A. Let ^7 = ^1 + ^2 + ^3 + L4. Prove that U = K- 

Note that dimf/ > dimLi = n — 2. If dimt/ = n — 2, then Li = L2 = L^ = L4 and the 
partition {E^} is not primitive for n > 3. 

Suppose that dimf/ = n — 1 and let, without loss of generality, U = {(x, 0) : x G Vn-i}. 
Denote Ui = Ei H U. Since {Ei} is a partition, Ei = Ui + {0, . . . ,0, hi) for some hi G F2, 
where there are two O's and two I's among {hi}. Assume for simplicity that hi = 62 and 
therefore h^ = h^. Then UiU U2 = Vn-i and t/3 U f/4 = Vn-\- As we show later, it yields 



L\ = L2 and L3 = L4. Now using (11) we obtain 



dim(Li n L2 n L3 n L4) = dim(Li n L3) > n - 3 
and the partition {Ei} is not primitive for n > 4. 
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B. Prove that dij = dini(Lj fl Lj) = n — 3 for all 1 < i < j < 4. 



By (11), the numbers d^j E {n — 3,n — 2}. Suppose that d^j = n — 2 for some i and j, 
say for z = 3 and j = 4. Then L^ = L4, 

dim(Li n L2 n L3 n L4) = dim(Li n L2 n L3) 

= dim(Li + L2 + L3) — dimLi — dimL2 — dimLs 

+ di2 + di3 + d23 

> n - 3{n - 2) + 3{n - 3) = n - 3, 

and the partition {Ei} is not primitive for n > 4. 

C. Prove that dijk = dim(Lj fl Lj fl L^) G {n — 4,72 — 3} for all 1 < i < j < k < 4 and 
moreover dijk 7^ n — 3 for n > 4. 

Indeed, dijk < dij = n — 3 and 

dijk = dimLj + dim(Lj fl Lk) - dim(Lj + {Lj fl Lk)) 
> (n - 2) + (n - 3) - dim(Li + Lj) = n - A. 

If some coefficient dijk is equal to n — 3, say di2s = n — 3, then 

dim((Li n L2 n L3) + L4) = di23 + dim L4, - dim(Li n L2 n L3 n L4) 

= {n-3) + {n-2) + = 2n-5. 

On the other hand, 

dim((Li n L2 n L3) + L4) < dim(Li + L4) = n - 1 

and we obtain the inequality 2n — 5 < n — 1 that doesn't hold for n > 4. 

Gathering A, B and C, we get 

dim(Li n L2 n L3 n L4) = 2J dimLj - ^J dij + 2J dijk - dim (2J -^0 

= 4(n - 2) - 6(n - 3) + ^ d^Jk - n 
> A{n - 2) - 6(n - 3) + 4(n - 4) - n = n - 6. 

Consequently, the partition {Ei} is primitive only if n < 6 and '^dijk = 3n — 10. Check these 
conditions. 

If n = 4, then two coefficients dijk are equal to n — 3 = 1, say di23 = (ii24 = 1- Then 
dim(Li n L2 n L3 n L4) = 1, a contradiction. If n = 5, then there exists dijk = n — 3 = 2, a. 
contradiction to the second part of C. Finally, if ra = 6, then 

dim(Li n L3) = dimLi + dimL3 — dim(Li + L3) 
< 8 - dim((Li n L2) + (L3 n L4)) 

= 8 - (dim(Li n L2) + dim(L3 n L4) - dim(Li n L2 H L3 n L4)) 
= 8- (3 + 3-0) =2 

that contradicts B. D 
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The above lemma allows to account all partitions of K+2 into planes of dimension r during 
the proof of the following result. 

° ° n 

Proposition 6. Let q = 2, r > 2, f G 3 2,r+2 be constructed by Propositionl^ and /(u, x), 
u G V2, X G Vr+2, be a corresponding bent function. By separate affine permutations of the 
variables u and x, / can he transformed into one of the following functions: 

5f(u,x) = uiU2{gi{x^,y) +5'2(a;3,y) +fi'3(a;3,y) +fl'4(a;3,y)) (12) 

+ ui{gi{x^,y) +gz{x-i,y) + xi) 

+ U2{gi{x^,y) + g2{.x^,y) + X2) 

+ ^i(a;3,y), 
5f(u,x) = uiU2{gi{x^,y) +5'2(a;3,y) +fl'3(a;2,y) +5'4(a;2,y) +X2 + x^) (13) 

+ ui{gi{x^,y) +g^{x2,y) + xi) 

+ U2{gi{xz,y) +g2{,x^,y) + X2) 

+ ^1(3^3, y), 
5f(u,x) = uiU2{gi{x^,y) +g2{xi,y) + gz{xi +a;2 + X3,y) + gi{x2,y) + xi) (14) 

+ ui{gi{x:i,y) + gz{xi + X2 + X'i^y) +X2 + xz) 

+ U2{gi{x'i,y) +g2{xi,y) + X2) 

+ ^1(3^3, y), 

where x = {xi,X2,x^,y), y G K-i, 9i e S^. 

Proof. Consider partitions of V3 into planes of dimension 1. Denote such a plane {b, b + e} 
by [b, e]. Let Sj be the vector of V3 having only the ith coordinate nonzero. It is easy to check 
that every partition of V3 can be transformed into one of the following 

{[0, 63], [e2, 63], [ei, 63], [ei + ea, 63]}, 
{[0, 63], [ea, 63], [ei, es], [ei + 63, eg]}, 
{[0, 63], [62, ei], [e2 + 63, ei + 62 + 63], [ei + eg, 62]} 

by an affine permutation of coordinates. 

Choose some of these partitions, replace each its plane [b, e] = {b + ae: a G F2} by 
{(b,0) + a;(e,y): a G F2, y G K-i} and obtain the partition of K.+2 into the planes of 
dimension r. Call such a partition canonical (for example, a canonical partition was used 



in Example 12). Lemma ^ implies that each partition of K-+2 can be transformed into some 
canonical by an affine permutation of coordinates. Also introduce a canonical ordering of planes 
of partitions by which the lexicographically minimal vectors of consecutive planes are increased 



(cf. Example 12). 



Let a bent rectangle / be constructed by Proposition |5j using a partition {-Eu}- By an 

affine permutation of columns of / , the partition {-Eu} can be transformed into some canonical 
and by an affine permutation of rows, the canonical ordering of planes can be achieved. Thus, 
it is sufficient to consider bent rectangles g built by the canonical partitions {-Eu} under the 
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canonical ordering and determine the corresponding bent functions g{u,x.). To do this, we can 
use the stretching equations (|8]), (|9| to calculate the restrictions of (7 to x and then utilize the 
representation 

g{ui,U2,^)= ^ (mi + ai + l)(M2 + tt2 + l)fi'(ai,a2,x). 

a 

For example, if g is built by the third canonical partition, then its restrictions to x look as 
follows: 

^(0,0, x) =^i(x3,y), 

5f(0, l,x) =5f2(xi,y) +X2, 

g{l, 0, x) = 5(3(0:1 + X2 + X3, y) + 0:2 + X3, 

g{l, 1, x) = gi{x2, y) + xi + X3 



and we obtain ( 14 ) . D 

n 

It is interesting that if / G 'B 2,r+2 is constructed by Proposition p^ and /i(x), /2(x), /3(x), 
/4(x) are the restrictions of /(u, x) to x, then all the functions /« + f), 1 < i < j < 4, are 
balanced, that is, they take the values and 1 equally often. 



Indeed, if g{u,x.) has one of the forms (12) — (14), then each sum of two its distinct 



restrictions to x is balanced. It is easily follows from the form of g and the fact that 
/i(x) = h*{xi, . . . ,Xk-i,Xk+i, ■ ■ ■ ,Xr+2) + Xk and all derived functions cr(/i)(x), a G AGLr+2, 
are balanced. By Proposition [6} / can be obtained from g by separate affine permutations of u 
and X. But a permutation of u only rearrange the restrictions, and a permutation of x doesn't 
change the balance of their sums. 
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